2ab99b4649c2902f56d76d3cfc32892e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ab99b4649c2902f56d76d3cfc32892e_JaffaCakes118
Size

237KB
MD5

2ab99b4649c2902f56d76d3cfc32892e
SHA1

8572d03545608eb856c95c90b9bc4ee723a123b6
SHA256

45e27f7c6cc2b80d1cb8c916723206e61a588d2af09b2c6f92fd5d46dae5bf80
SHA512

ec6495419525e1ff90a4b32b60b7e3b0fe104cd33f009832dc1f9767dfcc69cd1cd21bb53f037837d2f69aa09bd5872f0a130aec12783a55a6da15dba234d676
SSDEEP

6144:byFB3JFvDreljZDxsdA/6SdL/hChEM4AMc:6Jre1NCe/hCzUc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ab99b4649c2902f56d76d3cfc32892e_JaffaCakes118

Files

2ab99b4649c2902f56d76d3cfc32892e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

543c9cc540f6b4306c1cac9e251f71a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

strncmp
perror
malloc
free
exit
fread
fopen
fgets
strrchr
fclose
fwrite
printf
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
sprintf
getenv
_XcptFilter
_iob
fprintf
_exit
__p___initenv
_strdup
_stat

kernel32

GetModuleHandleA
GetModuleFileNameA
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 227KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE